Summary

Multiple products contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on a targeted system.

The vulnerability is due to an implementation flaw in the code responsible for handling the hashing functionality in the affected products. A hash table provides the data structure to store user-supplied input using a mathematical property in an effort to minimize the overhead to access a given record. A good hashing function ensures uniqueness of each entry while calculating the location for a set of inputs. However, most implementations do not include mechanisms such as randomized hash functions. As a result, the function could fail to identify occurrences of hash collisions for multiple string patterns.

An unauthenticated, remote attacker could exploit the vulnerability by submitting malicious HTTP POST requests that contain a sequence of string patterns that could generate similar hash keys to a vulnerable application. Processing these requests could introduce multiple hash collisions, and the algorithmic complexity for adding an item into the hash table could increase significantly. The increased complexity could consume excessive system resources, leading to a DoS condition on the system.

Apache has confirmed the vulnerability in the svn repository. Reports indicate patches are under development and will be released soon.

Microsoft has released a security bulletin at the following link: MS11-100. Microsoft customers can obtain updates directly by using the links in the security bulletin. These updates are also distributed by Windows automatic update features and available on the Windows Update website. Microsoft Windows Server Update Services (WSUS), Systems Management Server, and System Center Configuration Manager can assist administrators in deploying software updates.

VMware has notified customers that updated patches are pending for ESXi versions 4.1 and prior.

Revision History

Version

Description

Section

Date

19

HP has released an additional security bulletin and software updates to address the multiple products hash collisions denial of service vulnerability.

2015-June-10 13:24 GMT

18

Juniper has released a security advisory and updated software to address the multiple products hash collisions denial of service vulnerability.

2015-January-15 13:26 GMT

17

Apple has released an additional security advisory and updated software to address the multiple products hash collisions denial of service vulnerability.

2013-September-20 15:17 GMT

16

Red Hat has released an additional security advisory and updated packages to address multiple products hash collisions denial of service vulnerability. CentOS has also released updated packages to address this vulnerability.

2013-February-01 15:56 GMT

15

Red Hat has released additional security advisories and updated packages to address multiple products hash collisions denial of service vulnerability.

2012-December-21 15:20 GMT

14

VMware has released an additional security advisory and updated patches to address the hash collisions denial of service vulnerability found in multiple products.

2012-September-04 22:15 GMT

13

VMware has released a security advisory and updated patches to address the hash collisions denial of service vulnerability found in multiple products.

2012-July-17 15:35 GMT

12

HP has released an additional security bulletin and updated software to address the hash collisions denial of service vulnerability found in multiple products.

2012-June-29 13:23 GMT

11

Apple has released a security advisory and updated software to address the multiple products hash collisions denial of service vulnerability.

2012-May-10 15:10 GMT

10

Oracle has released a security advisory and patches to address multiple products hash collisions denial of service vulnerability.

2012-April-20 16:45 GMT

9

HP has released an additional security bulletin and updated software to address multiple products hash collisions denial of service vulnerability.

2012-April-17 18:58 GMT

8

Red Hat has released additional security advisories and updated packages to address multiple products hash collisions denial of service vulnerability. CentOS has also released updated packages to address this vulnerability.

2012-February-24 15:54 GMT

7

HP has released a security bulletin to address the multiple products hash collisions denial of service vulnerability.

2012-February-07 15:34 GMT

6

Red Hat has released additional security advisories and updated packages to address multiple products hash collisions denial of service vulnerability. CentOS has also released updated packages to address this vulnerability.

2012-January-31 15:54 GMT

5

IBM has released a flash alert and fixes to address the multiple products hash collisions denial of service vulnerability.

2012-January-23 20:11 GMT

4

Red Hat has released an additional security advisory and updated packages to address the multiple products hash collisions denial of service vulnerability. CentOS has also released updated packages to address this vulnerability.

2012-January-19 18:51 GMT

3

FreeBSD has released an additional VuXML document and updated ports collection to address the multiple products hash collisions denial of service vulnerability.

2012-January-17 23:08 GMT

2

FreeBSD has released a VuXML document and updated ports collection to address the multiple products hash collisions denial of service vulnerability. Red Hat and CentOS have also released a security advisory and updated packages to address this vulnerability.

2012-January-12 16:26 GMT

1

Multiple products contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service condition. Updates are available.

Legal Disclaimer

THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A
PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM
THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE ALERTS AT ANY TIME.

A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products